Need advice about which tool to choose?Ask the StackShare community!

Keywhiz

11
41
+ 1
3
Vault

594
611
+ 1
68
Add tool

Keywhiz vs Vault: What are the differences?

Keywhiz: A system for distributing and managing secrets. Keywhiz is a secret management and distribution service that is now available for everyone. Keywhiz helps us with infrastructure secrets, including TLS certificates and keys, GPG keyrings, symmetric keys, database credentials, API tokens, and SSH keys for external services — and even some non-secrets like TLS trust stores. Automation with Keywhiz allows us to seamlessly distribute and generate the necessary secrets for our services, which provides a consistent and secure environment, and ultimately helps us ship faster; Vault: Secure, store, and tightly control access to tokens, passwords, certificates, API keys, and other secrets in modern computing. Vault is a tool for securely accessing secrets. A secret is anything that you want to tightly control access to, such as API keys, passwords, certificates, and more. Vault provides a unified interface to any secret, while providing tight access control and recording a detailed audit log.

Keywhiz and Vault can be primarily classified as "Secrets Management" tools.

Some of the features offered by Keywhiz are:

  • Keywhiz Server provides JSON APIs for accessing and managing secrets. It is written in Java and based on Dropwizard.
  • KeywhizFs is a FUSE-based file system, providing secrets as if they are files in a directory. Transparently, secrets are retrieved from a Keywhiz Server using mTLS with a client certificate.
  • Presenting secrets as files makes Keywhiz compatible with nearly all software. Outside of Keywhiz administration, consumers of secrets only have to know how to read a file.

On the other hand, Vault provides the following key features:

  • Secure Secret Storage: Arbitrary key/value secrets can be stored in Vault. Vault encrypts these secrets prior to writing them to persistent storage, so gaining access to the raw storage isn't enough to access your secrets. Vault can write to disk, Consul, and more.
  • Dynamic Secrets: Vault can generate secrets on-demand for some systems, such as AWS or SQL databases. For example, when an application needs to access an S3 bucket, it asks Vault for credentials, and Vault will generate an AWS keypair with valid permissions on demand. After creating these dynamic secrets, Vault will also automatically revoke them after the lease is up.
  • Data Encryption: Vault can encrypt and decrypt data without storing it. This allows security teams to define encryption parameters and developers to store encrypted data in a location such as SQL without having to design their own encryption methods.

Keywhiz and Vault are both open source tools. Vault with 12.8K GitHub stars and 1.93K forks on GitHub appears to be more popular than Keywhiz with 2.09K GitHub stars and 166 GitHub forks.

Get Advice from developers at your company using Private StackShare. Sign up for Private StackShare.
Learn More
Pros of Keywhiz
Pros of Vault
  • 3
    Fuse FS
  • 16
    Secure
  • 11
    Variety of Secret Backends
  • 11
    Very easy to set up and use
  • 8
    Dynamic secret generation
  • 5
    AuditLog
  • 3
    Leasing and Renewal
  • 3
    Privilege Access Management
  • 2
    Open Source
  • 2
    Consol integration
  • 2
    Handles secret sprawl
  • 2
    Variety of Auth Backends
  • 2
    Easy to integrate with
  • 1
    Multicloud

Sign up to add or upvote prosMake informed product decisions

Sign up to add or upvote consMake informed product decisions

What is Keywhiz?

Keywhiz is a secret management and distribution service that is now available for everyone. Keywhiz helps us with infrastructure secrets, including TLS certificates and keys, GPG keyrings, symmetric keys, database credentials, API tokens, and SSH keys for external services — and even some non-secrets like TLS trust stores. Automation with Keywhiz allows us to seamlessly distribute and generate the necessary secrets for our services, which provides a consistent and secure environment, and ultimately helps us ship faster.

What is Vault?

Vault is a tool for securely accessing secrets. A secret is anything that you want to tightly control access to, such as API keys, passwords, certificates, and more. Vault provides a unified interface to any secret, while providing tight access control and recording a detailed audit log.

Need advice about which tool to choose?Ask the StackShare community!

What companies use Keywhiz?
What companies use Vault?
    No companies found
    See which teams inside your own company are using Keywhiz or Vault.
    Sign up for Private StackShareLearn More

    Sign up to get full access to all the companiesMake informed product decisions

    What tools integrate with Keywhiz?
    What tools integrate with Vault?
      No integrations found

      Sign up to get full access to all the tool integrationsMake informed product decisions

      Blog Posts

      What are some alternatives to Keywhiz and Vault?
      AWS Secrets Manager
      AWS Secrets Manager helps you protect secrets needed to access your applications, services, and IT resources. The service enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle.
      Docker Secrets
      A container native solution that strengthens the Trusted Delivery component of container security by integrating secret distribution directly into the container platform.
      Doppler
      Stop struggling with scattered environment variables, hacking together home-brewed tools, and avoiding access controls. Keep your team and servers in sync with Doppler.
      Torus CLI
      Torus simplifies the modern development workflow enabling you to store, share, and organize secrets across services and environments. With Torus, you can standardize on one tool across all environments. Map Torus to your workflows using projects, environments, services, teams, and machines.
      SecretHub
      All software needs secrets to access other resources: encryption keys, API tokens, database passwords. Helps teams deploy those application secrets to any cloud with a secure, automatic and reproducible deployment process.
      See all alternatives